flamion/yap-backend

yap-backend's Issues

Get entry only checks if the user created the entry

If a user wants to access an entry on a board which he didn't create he isn't allowed to. The check if the user has access only checks for direct ownership, not indirect access via a board

Add link https://testseite.dragoncave.dev/reset to email when resetting password

Creating a new board returns HTTP 500

Last login time doesn't get updated

The last login timestamp gets set in the Database but is never updated. Should get updated when a new Token is requested

Add way to check the permissionlevel of a member

Get board member by id

Delete members from board via Email

Automatically clean old tokens from Database

What the title says. Old tokens don't get cleaned from the database. Neither do old password reset codes

Ignore email address capitalization

• Make new users email addresses lower case before inserting into database
• make email address lowercase in functions using the email address to find/work with users

Missing Documentation

/user/entries is missing from the documentation

Missing profile picture endpoint documentation

When sending a non existant file / empty file it just removes the profile picture and responds with bad request

Http 500 on PUT board

Boards

Add the boards management

• add boards in general
• Rework entries to exist on boards not for single users
• Give each user on creation a default board
• Migrate all existing entries to default board
• Enable board admins to add another user to a board
• Enable board admins to add another board admin
• Update Documentation

No option to edit a board

delete board endpoint faulty

it says /board/{board_id} but it is /boards/{board_id}

Create entry documentation

In the endpoint EntryID is specified, even though the BoardID is needed.

Add an ability to store frontend metadata in the backend

to be able to support custom frontend features, too specific for the backend

Password reset returns 500

Require password to delete user

Currently a user only needs a token to get deleted. This means anyone with a token can just delete the associated account

Rework board object

• Only include the userID in the board object and not the full object with all properties.
• Add array with member userIDs

Entry object has user in creator key

it would be more consistent and independent if the creator key was changed to creator_id and only contained the user_id

Password reset Endpoint

What the title says

Convert permissions to integer

^^^

changePassword Endpoint constraint check

Currently change password Endpoint doesn't do the constraint checks

Profile Pictures

Add profile picture support

incomplete response in create board documentation

the docs specify that the response is only a HTTP-status code but it also includes the board_id

No option to delete a board

Update documentation

The earlier documentation is not completely outdated but missing information and does not conform to the newer documentation format

Check if member is already member of a board before adding

same with the admin endpoint

Remove old traces of groups

Add ability to remove a member from a board

Endpoint to invalidate tokens

the title says it all